Abrams, L. (2021, January 14). Ryuk Ransomware Uses Wake-on-Lan To Encrypt Offline Devices. Retrieved February 11, 2021.
None recorded.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1016 System Network Configuration Discovery |
MalwareRyuk | Ryuk has called |
| T1021.002 SMB/Windows Admin Shares |
MalwareRyuk | Ryuk has used the C$ network share for lateral movement. |
| T1205 Traffic Signaling |
MalwareRyuk | Ryuk has used Wake-on-Lan to power on turned off systems for lateral movement. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
